EnvelopeGenerator/EnvelopeGenerator.API/Controllers/AnnotationController.cs

using DigitalData.Core.Abstraction.Application.DTO;
using DigitalData.Core.Exceptions;
using EnvelopeGenerator.Application.Common.Dto;
using EnvelopeGenerator.Application.Common.Extensions;
using EnvelopeGenerator.Application.Common.Interfaces.Services;
using EnvelopeGenerator.Application.Common.Notifications.DocSigned;
using EnvelopeGenerator.Application.EnvelopeReceivers.Queries;
using EnvelopeGenerator.Application.Histories.Queries;
using EnvelopeGenerator.Domain.Constants;
using EnvelopeGenerator.API.Extensions;
using EnvelopeGenerator.API.Models;
using MediatR;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using System.Dynamic;

namespace EnvelopeGenerator.API.Controllers;

/// <summary>
/// Manages annotations and signature lifecycle for envelopes.
/// </summary>
[Authorize(Policy = AuthPolicy.Receiver)]
[ApiController]
[Route("api/[controller]")]
public class AnnotationController : ControllerBase
{
    [Obsolete("Use MediatR")]
    private readonly IEnvelopeHistoryService _historyService;

    [Obsolete("Use MediatR")]
    private readonly IEnvelopeReceiverService _envelopeReceiverService;

    private readonly IMediator _mediator;

    private readonly ILogger<AnnotationController> _logger;

    /// <summary>
    /// Initializes a new instance of <see cref="AnnotationController"/>.
    /// </summary>
    [Obsolete("Use MediatR")]
    public AnnotationController(
        ILogger<AnnotationController> logger,
        IEnvelopeHistoryService envelopeHistoryService,
        IEnvelopeReceiverService envelopeReceiverService,
        IMediator mediator)
    {
        _historyService = envelopeHistoryService;
        _envelopeReceiverService = envelopeReceiverService;
        _mediator = mediator;
        _logger = logger;
    }

    /// <summary>
    /// Creates or updates annotations for the authenticated envelope receiver.
    /// </summary>
    /// <param name="psPdfKitAnnotation">Annotation payload.</param>
    /// <param name="cancel">Cancellation token.</param>
    [Authorize(Policy = AuthPolicy.Receiver)]
    [HttpPost]
    [Obsolete("PSPDF Kit will no longer be used.")]
    public async Task<IActionResult> CreateOrUpdate([FromBody] PsPdfKitAnnotation? psPdfKitAnnotation = null, CancellationToken cancel = default)
    {
        var signature = User.GetReceiverSignatureOfReceiver();
        var uuid = User.GetEnvelopeUuidOfReceiver();

        var envelopeReceiver = await _mediator.ReadEnvelopeReceiverAsync(uuid, signature, cancel).ThrowIfNull(Exceptions.NotFound);

        if (!envelopeReceiver.Envelope!.ReadOnly && psPdfKitAnnotation is null)
            return BadRequest();

        if (await _mediator.IsSignedAsync(uuid, signature, cancel))
            return Problem(statusCode: StatusCodes.Status409Conflict);
        else if (await _mediator.AnyHistoryAsync(uuid, new[] { EnvelopeStatus.EnvelopeRejected, EnvelopeStatus.DocumentRejected }, cancel))
            return Problem(statusCode: StatusCodes.Status423Locked);

        var docSignedNotification = await _mediator
            .ReadEnvelopeReceiverAsync(uuid, signature, cancel)
            .ToDocSignedNotification(psPdfKitAnnotation)
            ?? throw new NotFoundException("Envelope receiver is not found.");

        await _mediator.PublishSafely(docSignedNotification, cancel);
        await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);

        return Ok();
    }

    /// <summary>
    /// Rejects the document for the current receiver.
    /// </summary>
    /// <param name="reason">Optional rejection reason.</param>
    [Authorize(Policy = AuthPolicy.Receiver)]
    [HttpPost("reject")]
    [Obsolete("Use MediatR")]
    public async Task<IActionResult> Reject([FromBody] string? reason = null)
    {
        var signature = User.GetReceiverSignatureOfReceiver();
        var uuid = User.GetEnvelopeUuidOfReceiver();
        var mail = User.GetReceiverMailOfReceiver();

        var envRcvRes = await _envelopeReceiverService.ReadByUuidSignatureAsync(uuid: uuid, signature: signature);

        if (envRcvRes.IsFailed)
        {
            _logger.LogNotice(envRcvRes.Notices);
            return Unauthorized("you are not authorized");
        }

        var histRes = await _historyService.RecordAsync(envRcvRes.Data.EnvelopeId, userReference: mail, EnvelopeStatus.DocumentRejected, comment: reason);
        if (histRes.IsSuccess)
        {
            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
            return NoContent();
        }

        _logger.LogEnvelopeError(uuid: uuid, signature: signature, message: "Unexpected error happened in api/envelope/reject");
        _logger.LogNotice(histRes.Notices);
        return StatusCode(500, histRes.Messages);
    }

    /// <summary>
    /// Returns the signature placeholders (id, page, x, y, width, height)
    /// the authenticated receiver must sign on the current envelope.
    /// Used by the Blazor receiver UI to render a custom signature overlay
    /// on top of the DevExpress PDF viewer.
    /// </summary>
    [Authorize(Policy = AuthPolicy.Receiver)]
    [HttpGet("elements")]
    public async Task<IActionResult> GetElements(CancellationToken cancel)
    {
        var signature = User.GetReceiverSignatureOfReceiver();
        var uuid = User.GetEnvelopeUuidOfReceiver();

        var envelopeReceiver = await _mediator.ReadEnvelopeReceiverAsync(uuid, signature, cancel)
            ?? throw new NotFoundException("Envelope receiver is not found.");

        var elements = envelopeReceiver.Envelope?.Documents?.FirstOrDefault()?.Elements
            ?? Enumerable.Empty<Application.Common.Dto.SignatureDto>();

        // Only expose what the overlay needs (no internal columns).
        var payload = elements
            .Where(e => e.ReceiverId == envelopeReceiver.ReceiverId)
            .Select(e => new
            {
                id       = e.Id,
                page     = e.Page,
                x        = e.X,
                y        = e.Y,
                width    = e.Width,
                height   = e.Height,
                required = e.Required,
                tooltip  = e.Tooltip,
            });

        return Ok(payload);
    }

    /// <summary>
    /// Signs the document for the authenticated receiver using a Blazor /
    /// DevExpress friendly payload (one PNG image per placeholder, plus
    /// optional position / city per placeholder).
    ///
    /// Internally produces a <see cref="PsPdfKitAnnotation"/> wrapping a
    /// list of <see cref="AnnotationCreateDto"/> entries so that the
    /// existing notification pipeline (mail / status / annotation persistence)
    /// is fully reused. The Instant JSON is left blank because the Blazor
    /// pipeline does not depend on PSPDFKit-side rendering.
    /// </summary>
    [Authorize(Policy = AuthPolicy.Receiver)]
    [HttpPost("blazor")]
    public async Task<IActionResult> SignBlazor([FromBody] BlazorSignaturePayload payload, CancellationToken cancel)
    {
        if (payload is null || payload.Signatures.Count == 0)
            return BadRequest();

        var signature = User.GetReceiverSignatureOfReceiver();
        var uuid = User.GetEnvelopeUuidOfReceiver();

        var envelopeReceiver = await _mediator.ReadEnvelopeReceiverAsync(uuid, signature, cancel)
            ?? throw new NotFoundException("Envelope receiver is not found.");

        if (await _mediator.IsSignedAsync(uuid, signature, cancel))
            return Problem(statusCode: StatusCodes.Status409Conflict);

        if (await _mediator.AnyHistoryAsync(uuid, new[] { EnvelopeStatus.EnvelopeRejected, EnvelopeStatus.DocumentRejected }, cancel))
            return Problem(statusCode: StatusCodes.Status423Locked);

        // Build a structured AnnotationCreateDto list out of the lightweight
        // payload. One DTO per (element, kind) tuple, mirroring how the legacy
        // PSPDFKit pipeline produced multiple form fields per placeholder.
        var structured = new List<AnnotationCreateDto>();
        foreach (var entry in payload.Signatures)
        {
            structured.Add(new AnnotationCreateDto
            {
                ElementId = entry.ElementId,
                Name      = $"{entry.ElementId}#signature",
                Type      = "signature",
                Value     = entry.SignatureDataUrl,
            });
            if (!string.IsNullOrWhiteSpace(entry.Position))
            {
                structured.Add(new AnnotationCreateDto
                {
                    ElementId = entry.ElementId,
                    Name      = $"{entry.ElementId}#position",
                    Type      = "position",
                    Value     = entry.Position!,
                });
            }
            if (!string.IsNullOrWhiteSpace(entry.City))
            {
                structured.Add(new AnnotationCreateDto
                {
                    ElementId = entry.ElementId,
                    Name      = $"{entry.ElementId}#city",
                    Type      = "city",
                    Value     = entry.City!,
                });
            }
            structured.Add(new AnnotationCreateDto
            {
                ElementId = entry.ElementId,
                Name      = $"{entry.ElementId}#date",
                Type      = "date",
                Value     = entry.SignedAt.ToString("o"),
            });
        }

        // No PSPDFKit Instant JSON for the Blazor flow — pass an empty object.
        var psPdfKitAnnotation = new PsPdfKitAnnotation(new ExpandoObject(), structured);

        var docSignedNotification = await _mediator
            .ReadEnvelopeReceiverAsync(uuid, signature, cancel)
            .ToDocSignedNotification(psPdfKitAnnotation)
            ?? throw new NotFoundException("Envelope receiver is not found.");

        await _mediator.PublishSafely(docSignedNotification, cancel);
        await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);

        return Ok();
    }
}